HowTo: Install MullvadVPN & Browser on Fedora Atomic Desktops

Ask Fedora
, , , , ,
1

MullvadVPN is a VPN service that advertizes with good privacy. They accept crypto or cash payments and have opensource and audited VPN clients, also for Fedora.

They maintain a Fedora Repository but of course have no instructions on how to install it on Fedora Atomic Desktops.

1. Add the repo

curl -SsL https://repository.mullvad.net/rpm/stable/mullvad.repo | pkexec tee /etc/yum.repos.d/mullvad.repo

This also works without using sudo

2. Install it

rpm-ostree install --reboot mullvad-vpn

Note: the same repo also offers mullvad-browser, a variant of torbrowser without tor, with the VPN instead.

(I personally recommend Librewolf+System VPN instead, as just tunneling the browser traffic may not be enough. Use TorBrowser for real anonymity.)

3. Enable the VPN

Dnf allows to run postinstall scripts, at least these are not working in rpm-ostree.

systemctl enable --now mullvad-daemon.service

4. Control the VPN

Tray icon

The VPN uses a tray icon, on Silverblue you can use this GNOME extension instead or restore tray icons with this one

CLI

You can also control it via the terminal.

mullvad -h

Split tunneling

Example: spawn a flatpak app without using the VPN

mullvad-exclude flatpak run org.localsend.localsend_app

You can create a desktop entry (the icon with text in your app menu), so that the app will always be spawned in split tunneling mode:

1. Copy the system desktop entry to the editable user location

cp /var/lib/flatpak/exports/share/applications/org.localsend.localsend_app.desktop ~/.local/share/applications/

2. Manipulate the Start command

sed -i 's/Exec=/Exec=mullvad-exclude /g' ~/.local/share/applications/org.localsend.localsend_app.desktop

This app entry will be shown instead of the original one (as they have the same name) and your app will now work in your local network!

other example, Syncthing: flatpak search syncthing --columns=application

3 Likes
2

Hello. Thank you for this guide. I’m having a small issue. I’m on Fedora 40 Kinoite. When I run the command curl -SsL https://repository.mullvad.net/rpm/stable/mullvad.repo | pkexec tee > /etc/yum.repos.d/mullvad.repo I get the output bash: /etc/yum.repos.d/mullvad.repo: Permission denied

Perhaps I must use sudo after all?

3

I got it working by running the first command in a root terminal (sudo didn’t do the trick). Please note that I’m very new to atomic desktops and not very experienced with Linux in general. :sweat_smile:

1 Like
4

Like in the other thread, pkexec tee > /etc/yum.repos.d/mullvad.repo, the pkexec command is applied to tee but not to the redirection. So the correct command is simply

curl -SsL https://repository.mullvad.net/rpm/stable/mullvad.repo | pkexec tee /etc/yum.repos.d/mullvad.repo

It is a bit complicated for me to explain why you get Permission denied. In short, it is because the redirection (>, >>, etc.) is not executed with elevated permissions (sudo or pkexec), but the redirection is actually executed by the current user’s shell. Or in other words, e.g in sudo baz > /foo/bar, the redirection part ( > /foo/bar) is not part of the sudo baz command.

1 Like
5

Thanks! I think your “improved” command was the same, you probably meant to remove the redirect symbol.

I will check to do this in the future :slight_smile:

6

Indeed. Sorry[1]. I just edited the command.

  1. damned copy&paste :slight_smile: ↩︎

7

Thanks for showing how we can add a repo in Atomic desktops. It really helps extend the utility of them. May I please ask, would any repos that were added like this require extra steps between major releases like RPM Fusion does?

In their case, the repos have to be removed and re-installed all over again. Here, the app developer seems to have added the repo without a specific version of Fedora in mind. Does that mean apps with similar repos also don’t require RPM Fusion type extra steps?

8

The rpmfusion problem is the same as on traditional Fedora, that an external repo needs to follow the versions dynamically, or if the version is fixed, the repo needs to be changed before the update can be done.

On traditional systems this is extremely messy, as you change the system to the new one, while using the old one. So you change the repo, and download the new package, while using the old package, and swap them on the same system. It is a mess, and I personally got stuck in weird “states in between” quite a lot.

Rpmfusion bypasses that issue by using packages you install, rather than repo files you add manually. These packages will auto-update on upgrades afaik. See their official docs.

MullvadVPN may just use a dynamic RPM version with $(rpm -E %fedora)

9

I see. Then, I imagine the situation to be similar with the Tailscale example from the official documentation.

Side note, I actually used your instructions to install Mullvad Browser instead. I noticed that Mullvad instructions for both the VPN and browser added the same repo in their instructions, so once I added the repo, all I needed was to run:

rpm-ostree install mullvad-browser

I thought you could mention that functionality in your post, in case someone misses it down here.